This section is intended to introduce the reader to various aspects of art, which may be related to various aspects of the present invention that are described and/or claimed below. This discussion is believed to be helpful in providing the reader with background information to facilitate a better understanding of the various aspects of the present invention. Accordingly, it should be understood that these statements are to be read in this light, and not as admissions of prior art.
Many different types of systems may be implemented to monitor a data stream including a number of measured values. In systems such as medical systems, environmental systems, and financial markets, for instance, managed computer systems may be implemented to monitor data. A data stream may include measured values representing disk response times, heart rates, sales volumes, or temperatures, for example. In many instances, it may be desirable to monitor a data stream to detect that the system is in a particular state or that particular events, such as changes in the data or changes in some distribution or parameter of the data, have occurred and to activate an alarm upon detection. As can be appreciated, while there may be considerable variations between individual values being measured in a data sequence, when a system is stable, the measured values being monitored may be usefully modeled as having been drawn from a single statistical distribution. In certain instances, changes in the values being monitored by the system or distributions of the data may advantageously be detected by the monitoring system such that some action, such as the raising of an alarm, may be initiated.
One conventional solution to detecting a change in data is to display the measured values statistically or graphically, for example, such that a human observer can monitor the data. Disadvantageously, to implement such a supervised detection system, if the system is monitoring a number of traces, human monitoring may be unreliable and impractical. Further, while a change in the data stream may be statistically significant, the magnitude of the change may be so small that it may be difficult for a human observer to ascertain the change in a reasonably short period of time. This is often the case when considering a change in mean significantly less than the standard deviation of the original distribution, for example. Still further, there are many types of changes that human observers cannot ascertain based on the data stream being monitored. That is to say, it may be desirable to monitor changes that may only be noticeable through data manipulation or transformation. For example, while a human observer may notice a change in the mean or standard deviation of a data stream, the human observer may not be able to detect a change in the standard deviation of the frequency of spikes or zero crossings. Disadvantageously, human observers may not be able to adequately detect changes in certain types of data being monitored by certain computer systems.
Another technique for detecting a change is to implement a programmatic detector. A programmatic detector receives the data and automatically raises an alarm if the data or some distribution or parameter of the data crosses a static threshold. The threshold may be user-selected or factory-selected, for instance. The detector may be configured to trigger the alarm immediately upon receiving a data value (or upon computing a value based on received data values) outside of the threshold, or the detector may produce output correlated with the detector's confidence that a change has actually occurred. As can be appreciated, for these programmatic detectors, threshold and/or confidence levels are generally set manually or automatically before the detector is implemented.